fix(redaction): do not redact URI passwords that run through a line break
What changed
AI coding session redaction no longer replaces a generic-credential-uri match whose password runs through a line break.
The scanner sees the session JSON-encoded, where a line break is the escape \n, and the rule's password group stops only at real whitespace. In a written .env file the match ran from a host and port (http://localhost:48002), through the next lines, to the @ of an email address on a later line. The session was then annotated as containing a secret, ai-config-no-secrets failed, and the replaced lines were lost from the transcript.
A URI cannot contain a line break, so the embedded ruleset now allowlists such a match. Only a real escape counts (an odd run of backslashes before n, r or t). A real credential URI on a later line has its own ://, which the password group cannot run through, so it is still found and redacted.
The redaction ruleset version goes to 3, so that policies can tell these sessions apart from earlier ones.
This change was made with AI assistance (Claude Code).
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill